1. Controller and contact
The controller responsible for personal data processed in Zugkunft and on this website is:
Kai Schwabe
Silberburgstraße 30
70176 Stuttgart
Germany
For questions about your data or to exercise your rights, email privacy@zugkunftapp.com. For general enquiries, contact hello@zugkunftapp.com; for help with the app, contact support@zugkunftapp.com.
2. Website and connection data
Independently of your browser analytics choice, we use aggregate server request statistics to operate and improve this website: hourly counts for fixed public pages and assets, App Store redirects, response codes, and data volume. Cloudflare produces these totals from requests it already handles to deliver the website. Only hourly totals and fixed categories are sent to PostHog; no visitor IP addresses, browser identifiers, user agents, referrers, query strings, or private journey links are sent. No extra script, cookie, fingerprint, or device-storage access is used for these counters. They cannot measure unique visitors or reconstruct individual visits. Requests from bots and repeat loads may be included. The legal basis for preparing these limited statistics is our legitimate interest in a reliable, useful website under Article 6(1)(f) GDPR; you can object at privacy@zugkunftapp.com.
Browser analytics is off until you choose “Allow”. With your permission, PostHog, Inc., USA, with EU hosting, receives page views and selected clicks: App Store links, feature links, language switches, and contact categories. We send only fixed page categories and language, without query strings, URL fragments, raw referrers, email content, session recordings, or person profiles. This website does not set analytics cookies.
Cloudflare, Inc., USA, delivers the website and operates the infrastructure for the Zugkunft service. This involves processing necessary connection data such as your IP address, request time, requested URL, and browser or app information. This data supports delivery, troubleshooting, and protection against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, reliable service. Article 6(1)(b) GDPR also applies to requests needed to use the app.
The legal basis for optional website analytics and browser storage is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Your choice is stored in this browser; after accepting, a separate random browser identifier is stored for up to 180 days. It is never linked to your app or cloud account. Browser “Do Not Track” and Global Privacy Control requests are respected. You can withdraw at any time using “Analytics settings” in the footer. New exports stop and the browser identifier is removed; data already transmitted is not recalled. Only visitors who allow analytics appear in these measurements.
Your IP address is needed to connect to PostHog but is replaced in event properties, and location enrichment is disabled. To request erasure of website events, email privacy@zugkunftapp.com. The intended maximum raw-event retention is 90 days. Automated deletion and individual erasure still depend on provider support and have not been verified; we cannot currently confirm that limit is enforced.
Connection and security data is processed for as long as needed to deliver the service, investigate technical issues, or address specific abuse. Further information about Cloudflare’s processing is available in the Cloudflare Privacy Policy.
3. Calendar and journey imports
Calendar Sync is optional. After you grant access, Zugkunft reads calendar data and identifies supported DB journeys on your iPhone. iOS requires full Calendar access because it does not offer a read-only permission. Calendar titles, notes, calendar names, and local or external event identifiers are not sent to the Zugkunft server.
For Cloud Sync and tracking, the extracted journey segments are transmitted with their train identifiers, origin and destination stations, scheduled times, and a random import identifier. Content imported through the share sheet is also parsed on your device; the extracted journey segments are transmitted.
Your imported journeys are processed to provide the app features you request (Article 6(1)(b) GDPR). You can turn off Calendar Sync in Zugkunft and revoke Calendar access in iOS Settings. Previously imported journeys remain until you delete them. You can use Zugkunft without Calendar access.
4. Cloud Sync and Live Activities
You do not need to register with a name or email address. Zugkunft creates random account and device identifiers instead. These are pseudonymous and can link your journeys and devices. Credentials are stored in the iOS Keychain. Account credentials can sync between your devices through iCloud Keychain; device credentials stay on the individual device.
The service processes journey segments and their current status, device language, time zone, Live Activity preferences, and push tokens. Push tokens are encrypted on the server. Cloudflare operates the Zugkunft service. Timetable and real-time sources include DB Timetables and GTFS Deutschland. Requests to timetable services concern stations, trains, and times; they do not include calendar content or credentials.
Live Activities receive updates through Apple Push Notification service (APNs). Apple processes push tokens and the journey information needed for display. Journey information may be visible on your Lock Screen; you control its display in iOS Settings.
The legal basis is Article 6(1)(b) GDPR, to provide Cloud Sync, tracking, and the Live Activities you use. These features are unavailable without the data they require.
Sharing a journey
When you choose to share a journey, anyone with its link can see the route, trains, current timetable information, and expected arrival. The link does not share your name, calendar entries, booking details, fares, or device location. People can forward the link. Shared journey pages do not run visitor analytics or store the link in browser storage.
Recipients can view the journey without registering or save it in Zugkunft using the existing anonymous cloud identity. Starting a recipient Live Activity is a separate choice. The service stores the sharing permission, expiry, anonymous follow relationship, and encrypted activity push token needed for these features.
Access expires two hours after confirmed final arrival, and no later than 26 hours after the scheduled final arrival. Stop sharing, stop tracking, delete the journey or cloud account, or change the itinerary to invalidate the link. Usable link credentials are erased when sharing ends; redacted lifecycle records are deleted after 30 days. Activity dismissal uses the existing short-lived delivery queue. Information already seen or copied cannot be recalled, and an offline device may show its last update until it reconnects or its known expiry passes.
5. WIFIonICE
When the feature is enabled and Zugkunft is in the foreground, the app can retrieve data from the local ICE Portal over WIFIonICE. This includes stops, predicted times, journey phase, delays, and train series. Relevant status data may be sent to the Zugkunft service to keep your journey and Live Activity current. Speed and the approximate remaining distance are displayed locally in the app.
You can turn this feature off in Zugkunft. The legal basis for providing this feature is Article 6(1)(b) GDPR. The relevant operator’s privacy notices also apply to your use of the train Wi-Fi and ICE Portal.
6. Usage and diagnostics
Usage and diagnostics are enabled by default in telemetry-enabled releases to help improve Zugkunft. There is no telemetry choice during onboarding. You can turn sharing off under Settings → Privacy → Share usage and diagnostics without losing any app features. Existing disabled preferences remain off after an update; your choice is kept across restarts.
We use PostHog, Inc., USA, with EU hosting. Data includes selected usage events, such as a completed import, journey-sharing actions and outcomes, or confirmed Live Activity startup, coarse success and failure categories, app and operating system versions, and sanitized crash/error diagnostics. A random analytics identifier stays the same across app launches until you turn sharing off and is not linked to your Zugkunft account. This data is pseudonymous, not fully anonymous.
Calendar content, stations, specific train numbers, journey and account identifiers, sharing links and capabilities, share and follow identifiers, and push tokens are not passed to analytics. Automatic screen and interaction capture, session recordings, person profiles, and location enrichment are disabled. Your IP address is needed for the connection but is not stored as part of usage events. Website analytics has its own optional choice, as described in section 2.
Analytics records are retained for no more than 90 days and then deleted. Fully anonymized aggregate statistics may be kept longer.
You can turn sharing off at any time in the same settings. Further exports stop and locally queued telemetry and its identifier are deleted. The native crash handler may stay installed until the app process ends; reports from outside the active collection period are rejected. Enabling analytics again starts with a new identifier; discarded events are not sent later. Turning sharing off does not automatically erase data already transmitted. To request erasure, contact privacy@zugkunftapp.com. While sharing is enabled, “Request usage data deletion” in Privacy settings opens an email draft with the reference needed to find your records already included. Review and send the email to submit your request. Once sharing is turned off, that reference is no longer available in the app. Zugkunft does not link analytics identifiers to your account or email address as part of analytics.
Further information about the service’s privacy controls is available from PostHog.
7. Purchases through Apple
Apple handles in-app purchases. Zugkunft processes product and transaction identifiers, purchase and expiry dates, and entitlement status to unlock and restore purchased features. The random Zugkunft account identifier may be sent to Apple to associate the purchase with your account. Zugkunft does not receive credit card or bank account details.
The legal basis is Article 6(1)(b) GDPR. Apple processes payment and App Store data under its own responsibility. Further information is available in the Apple Privacy Policy.
8. Contact by email
If you email us, we process your email address, message content, and any details you choose to include so we can answer your request. We use Cloudflare, Inc., USA, to deliver email for zugkunftapp.com addresses. Where messages are forwarded to a mailbox, its email provider is also involved. Processing includes the sender and recipient details and message content needed for delivery. Further information is available in the Cloudflare Privacy Policy. Please send only information needed for your request, and do not send credentials or complete calendar entries.
For enquiries about using the app or a purchase, the legal basis is Article 6(1)(b) GDPR. Other enquiries are handled on the basis of our legitimate interest in responding to your message (Article 6(1)(f) GDPR); privacy requests are handled to meet our legal obligations (Article 6(1)(c) GDPR). Messages are deleted once the request is resolved and no statutory retention duties or necessary evidence require further storage.
9. Storage and deletion
The following retention periods apply to your data. Once a period expires, the data is removed during daily deletion.
- Journeys, passenger leg summaries, and account data remain until the journey or account is deleted.
- Deleting a journey removes its tracking data. An encrypted, instance-specific Live Activity end delivery may remain for up to 14 days if delivery is delayed; it is removed as soon as delivery finishes.
- Technical data for completed journey tracking and delivery identifiers no longer needed: seven days.
- Diagnostic data for timetable updates: seven days.
- Records of update delivery: 14 days.
- Records of changes and deletions, and data used to prevent duplicate processing: 30 days.
- Detailed timetable data no longer needed by any saved journey: 30 days.
Purchase entitlements are needed for as long as required to unlock or restore features or resolve purchase claims. Legally required records are retained for the applicable statutory period and then deleted. The periods above do not apply to data Apple processes independently or to the analytics described in section 6.
You can delete individual journeys in the app. Delete your complete cloud account in Zugkunft under Settings → Privacy → Delete cloud account. Calendar Sync stops and the app removes its local journey data and credentials. Existing Calendar events are kept. You can explicitly start again with an empty account. A secret-salted digest prevents stale devices from recreating a deleted account. For access or a data export, email privacy@zugkunftapp.com. Because your Zugkunft account is not linked to your email address, additional proof that the account belongs to you may be necessary. Do not send authentication secrets by email. Uninstalling the app alone does not delete the server account or necessarily remove credentials from iCloud Keychain.
10. Recipients and international processing
Recipients include the infrastructure, analytics, email, and platform providers described above, as needed for each activity. Cloudflare processes data on its global infrastructure, including in the USA. PostHog stores analytics data in the EU; access from other countries may still occur. Apple and email providers may also process data internationally.
Transfers outside the European Economic Area must be based on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, particularly EU Standard Contractual Clauses. Cloudflare describes these mechanisms in its Data Processing Addendum, and PostHog in its Data Processing Agreement. You can request information and copies of the relevant safeguards at privacy@zugkunftapp.com.
11. Your rights
Subject to the GDPR’s conditions, you have rights of access, rectification, erasure, restriction of processing, and data portability. You can withdraw consent at any time for the future; this does not affect the lawfulness of earlier processing.
Right to object: Where processing relies on legitimate interests, you can object on grounds relating to your particular situation. Contact privacy@zugkunftapp.com.
You may complain to a data protection authority, particularly where you live or work or where the suspected infringement occurred. The authority for the provider’s location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
Zugkunft does not make solely automated decisions that produce legal or similarly significant effects on you.